---
title: Tip: for Magento BlockStrap, confirm the October patch actually landed, and keep the September hotfix | ctxsec
url: https://ctxsec.com/items/tip-blockstrap-patch-check
description: ""
status: "tip (from vendor + Sansec guidance)"
published: 2026-10-16
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-blockstrap-patch-check.md)

tip (from vendor + Sansec guidance)

2026-10-16

### Tip: for Magento BlockStrap, confirm the October patch actually landed, and keep the September hotfix

Running `composer update` alone may not apply Adobe's fix for CVE-2026-103849, per Sansec. Check that you installed the 2026-oct release (2.4.7-p10, 2.4.8-p5 or the 2.4.9 patch) or Adobe's isolated patch from KB ka-49323, and that the VULN-39341 StyleSmuggler hotfix is still in place, since the two fixes are separate. Mage-OS users should upgrade the `mage-os/product-community-edition` metapackage to 3.6.0. If you can't patch within hours, put a WAF rule in front of the store and scan for backdoors after patching.

Sources: [Sansec research](https://sansec.io/research/blockstrap-magento-rce) · [Adobe APSB26-153](https://www.adobe.com/trust/security/products/commerce/apsb26-153.html)